c04f9ab43aca3284766cbb7d6408f513084dea32624f48154b43b93ef55bc162

Analysis

max time kernel
103s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f0e71fbc81a7e7e7601bc74539774f0N.exe
Size

128KB
MD5

5f0e71fbc81a7e7e7601bc74539774f0
SHA1

008b0054da78d4b8589b2ebfb7c03069e6d29b90
SHA256

c04f9ab43aca3284766cbb7d6408f513084dea32624f48154b43b93ef55bc162
SHA512

60921b7933c4bdaa33bf8e1edf519396423c10dc405ff7f4440f82885edd8549fd20130311dd430986432300685d1d22b073765753bc1a30148f804c5546e6f2
SSDEEP

3072:FHK35uyOXvBwPZyPcjPkEUClcyzdpGrLSHMPxMeEvPOdgujv6NLPfFFrKP9:Fq3OWgqeyzKrLUMJML3OdgawrFZKP

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 42 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	5f0e71fbc81a7e7e7601bc74539774f0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	5f0e71fbc81a7e7e7601bc74539774f0N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddjejl32.exe

Executes dropped EXE 21 IoCs

pid	Process
536	Cnffqf32.exe
1120	Ceqnmpfo.exe
2940	Cfbkeh32.exe
3620	Cmlcbbcj.exe
5064	Ceckcp32.exe
808	Cfdhkhjj.exe
3260	Cmnpgb32.exe
2032	Chcddk32.exe
1512	Cnnlaehj.exe
1204	Cegdnopg.exe
2452	Ddjejl32.exe
3616	Dfiafg32.exe
1912	Dopigd32.exe
3480	Dmcibama.exe
2388	Danecp32.exe
640	Ddmaok32.exe
4608	Dfnjafap.exe
3728	Dodbbdbb.exe
4856	Ddakjkqi.exe
5072	Deagdn32.exe
1308	Dmllipeg.exe

Drops file in System32 directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Ddmaok32.exe	Danecp32.exe
File created	C:\Windows\SysWOW64\Cmnpgb32.exe	Cfdhkhjj.exe
File opened for modification	C:\Windows\SysWOW64\Chcddk32.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Ingfla32.dll	Chcddk32.exe
File opened for modification	C:\Windows\SysWOW64\Danecp32.exe	Dmcibama.exe
File opened for modification	C:\Windows\SysWOW64\Cnffqf32.exe	5f0e71fbc81a7e7e7601bc74539774f0N.exe
File opened for modification	C:\Windows\SysWOW64\Dfiafg32.exe	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Jjjald32.dll	Danecp32.exe
File created	C:\Windows\SysWOW64\Kahdohfm.dll	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Lfjhbihm.dll	5f0e71fbc81a7e7e7601bc74539774f0N.exe
File created	C:\Windows\SysWOW64\Ceckcp32.exe	Cmlcbbcj.exe
File opened for modification	C:\Windows\SysWOW64\Cnnlaehj.exe	Chcddk32.exe
File created	C:\Windows\SysWOW64\Agjbpg32.dll	Dmcibama.exe
File opened for modification	C:\Windows\SysWOW64\Dfnjafap.exe	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Kdqjac32.dll	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Cnnlaehj.exe	Chcddk32.exe
File opened for modification	C:\Windows\SysWOW64\Dopigd32.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Danecp32.exe	Dmcibama.exe
File opened for modification	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cnffqf32.exe
File opened for modification	C:\Windows\SysWOW64\Cmnpgb32.exe	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Deagdn32.exe	Ddakjkqi.exe
File opened for modification	C:\Windows\SysWOW64\Ddmaok32.exe	Danecp32.exe
File opened for modification	C:\Windows\SysWOW64\Cfdhkhjj.exe	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Mgcail32.dll	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Kkmjgool.dll	Ddjejl32.exe
File opened for modification	C:\Windows\SysWOW64\Dmcibama.exe	Dopigd32.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Deagdn32.exe
File created	C:\Windows\SysWOW64\Cnffqf32.exe	5f0e71fbc81a7e7e7601bc74539774f0N.exe
File created	C:\Windows\SysWOW64\Cfbkeh32.exe	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Chcddk32.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Ghilmi32.dll	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Bilonkon.dll	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Poahbe32.dll	Ddmaok32.exe
File opened for modification	C:\Windows\SysWOW64\Cfbkeh32.exe	Ceqnmpfo.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Deagdn32.exe
File created	C:\Windows\SysWOW64\Dfnjafap.exe	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Eifnachf.dll	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Hfanhp32.dll	Cegdnopg.exe
File created	C:\Windows\SysWOW64\Kmfjodai.dll	Dopigd32.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Deagdn32.exe
File created	C:\Windows\SysWOW64\Dfiafg32.exe	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Hcjccj32.dll	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Ddakjkqi.exe	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Ddakjkqi.exe	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Deagdn32.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Ghekjiam.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cfbkeh32.exe
File opened for modification	C:\Windows\SysWOW64\Cegdnopg.exe	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Gifhkeje.dll	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Dmcibama.exe	Dopigd32.exe
File opened for modification	C:\Windows\SysWOW64\Ddjejl32.exe	Cegdnopg.exe
File opened for modification	C:\Windows\SysWOW64\Ceckcp32.exe	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Cfdhkhjj.exe	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Ffpmlcim.dll	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Ddjejl32.exe	Cegdnopg.exe
File created	C:\Windows\SysWOW64\Cegdnopg.exe	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Dopigd32.exe	Dfiafg32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4900	1308	WerFault.exe	106

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5f0e71fbc81a7e7e7601bc74539774f0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcibama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceckcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmjkjk32.dll"	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgcail32.dll"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjccj32.dll"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	5f0e71fbc81a7e7e7601bc74539774f0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdqjac32.dll"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghekjiam.dll"	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bilonkon.dll"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ingfla32.dll"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poahbe32.dll"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agjbpg32.dll"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifhkeje.dll"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffpmlcim.dll"	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfanhp32.dll"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Deagdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	5f0e71fbc81a7e7e7601bc74539774f0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eifnachf.dll"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Deagdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjjald32.dll"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	5f0e71fbc81a7e7e7601bc74539774f0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfjodai.dll"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmcibama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	5f0e71fbc81a7e7e7601bc74539774f0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghilmi32.dll"	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfjhbihm.dll"	5f0e71fbc81a7e7e7601bc74539774f0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kahdohfm.dll"	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	5f0e71fbc81a7e7e7601bc74539774f0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkmjgool.dll"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfiafg32.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 536	3580	5f0e71fbc81a7e7e7601bc74539774f0N.exe	84
PID 3580 wrote to memory of 536	3580	5f0e71fbc81a7e7e7601bc74539774f0N.exe	84
PID 3580 wrote to memory of 536	3580	5f0e71fbc81a7e7e7601bc74539774f0N.exe	84
PID 536 wrote to memory of 1120	536	Cnffqf32.exe	85
PID 536 wrote to memory of 1120	536	Cnffqf32.exe	85
PID 536 wrote to memory of 1120	536	Cnffqf32.exe	85
PID 1120 wrote to memory of 2940	1120	Ceqnmpfo.exe	86
PID 1120 wrote to memory of 2940	1120	Ceqnmpfo.exe	86
PID 1120 wrote to memory of 2940	1120	Ceqnmpfo.exe	86
PID 2940 wrote to memory of 3620	2940	Cfbkeh32.exe	87
PID 2940 wrote to memory of 3620	2940	Cfbkeh32.exe	87
PID 2940 wrote to memory of 3620	2940	Cfbkeh32.exe	87
PID 3620 wrote to memory of 5064	3620	Cmlcbbcj.exe	88
PID 3620 wrote to memory of 5064	3620	Cmlcbbcj.exe	88
PID 3620 wrote to memory of 5064	3620	Cmlcbbcj.exe	88
PID 5064 wrote to memory of 808	5064	Ceckcp32.exe	89
PID 5064 wrote to memory of 808	5064	Ceckcp32.exe	89
PID 5064 wrote to memory of 808	5064	Ceckcp32.exe	89
PID 808 wrote to memory of 3260	808	Cfdhkhjj.exe	90
PID 808 wrote to memory of 3260	808	Cfdhkhjj.exe	90
PID 808 wrote to memory of 3260	808	Cfdhkhjj.exe	90
PID 3260 wrote to memory of 2032	3260	Cmnpgb32.exe	91
PID 3260 wrote to memory of 2032	3260	Cmnpgb32.exe	91
PID 3260 wrote to memory of 2032	3260	Cmnpgb32.exe	91
PID 2032 wrote to memory of 1512	2032	Chcddk32.exe	92
PID 2032 wrote to memory of 1512	2032	Chcddk32.exe	92
PID 2032 wrote to memory of 1512	2032	Chcddk32.exe	92
PID 1512 wrote to memory of 1204	1512	Cnnlaehj.exe	93
PID 1512 wrote to memory of 1204	1512	Cnnlaehj.exe	93
PID 1512 wrote to memory of 1204	1512	Cnnlaehj.exe	93
PID 1204 wrote to memory of 2452	1204	Cegdnopg.exe	94
PID 1204 wrote to memory of 2452	1204	Cegdnopg.exe	94
PID 1204 wrote to memory of 2452	1204	Cegdnopg.exe	94
PID 2452 wrote to memory of 3616	2452	Ddjejl32.exe	95
PID 2452 wrote to memory of 3616	2452	Ddjejl32.exe	95
PID 2452 wrote to memory of 3616	2452	Ddjejl32.exe	95
PID 3616 wrote to memory of 1912	3616	Dfiafg32.exe	96
PID 3616 wrote to memory of 1912	3616	Dfiafg32.exe	96
PID 3616 wrote to memory of 1912	3616	Dfiafg32.exe	96
PID 1912 wrote to memory of 3480	1912	Dopigd32.exe	97
PID 1912 wrote to memory of 3480	1912	Dopigd32.exe	97
PID 1912 wrote to memory of 3480	1912	Dopigd32.exe	97
PID 3480 wrote to memory of 2388	3480	Dmcibama.exe	98
PID 3480 wrote to memory of 2388	3480	Dmcibama.exe	98
PID 3480 wrote to memory of 2388	3480	Dmcibama.exe	98
PID 2388 wrote to memory of 640	2388	Danecp32.exe	99
PID 2388 wrote to memory of 640	2388	Danecp32.exe	99
PID 2388 wrote to memory of 640	2388	Danecp32.exe	99
PID 640 wrote to memory of 4608	640	Ddmaok32.exe	100
PID 640 wrote to memory of 4608	640	Ddmaok32.exe	100
PID 640 wrote to memory of 4608	640	Ddmaok32.exe	100
PID 4608 wrote to memory of 3728	4608	Dfnjafap.exe	101
PID 4608 wrote to memory of 3728	4608	Dfnjafap.exe	101
PID 4608 wrote to memory of 3728	4608	Dfnjafap.exe	101
PID 3728 wrote to memory of 4856	3728	Dodbbdbb.exe	103
PID 3728 wrote to memory of 4856	3728	Dodbbdbb.exe	103
PID 3728 wrote to memory of 4856	3728	Dodbbdbb.exe	103
PID 4856 wrote to memory of 5072	4856	Ddakjkqi.exe	104
PID 4856 wrote to memory of 5072	4856	Ddakjkqi.exe	104
PID 4856 wrote to memory of 5072	4856	Ddakjkqi.exe	104
PID 5072 wrote to memory of 1308	5072	Deagdn32.exe	106
PID 5072 wrote to memory of 1308	5072	Deagdn32.exe	106
PID 5072 wrote to memory of 1308	5072	Deagdn32.exe	106

C:\Users\Admin\AppData\Local\Temp\5f0e71fbc81a7e7e7601bc74539774f0N.exe
"C:\Users\Admin\AppData\Local\Temp\5f0e71fbc81a7e7e7601bc74539774f0N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Windows\SysWOW64\Cnffqf32.exe
  C:\Windows\system32\Cnffqf32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\SysWOW64\Ceqnmpfo.exe
    C:\Windows\system32\Ceqnmpfo.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Windows\SysWOW64\Cfbkeh32.exe
      C:\Windows\system32\Cfbkeh32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2940
    - - C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3620
      - C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5064
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:808
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3260
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1512
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3480
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3728
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 408
        23⤵
        Program crash
        
        PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1308 -ip 1308
1⤵
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ceckcp32.exe

Filesize
128KB

MD5
f8fd84ff1c3ac1490566aeed9e9f50a4

SHA1
1c248c0389117b25a44310e8450709665478eaf3

SHA256
186edbd2af779a1bd99d1eccee464918b320ab9edc1278ba019067c56dc76868

SHA512
56580188f192463588e6f1a47754d41f0614eb1ff9e4807860bd6dc500bb59c7cb6458544251966f11aead47affb821768754754f93ca78dd790758d4df84ab6

Download Submit
C:\Windows\SysWOW64\Cegdnopg.exe

Filesize
128KB

MD5
98a4e1370b65614848ca866a8db7eb42

SHA1
4e26f4ecf5fa3b4ec532c5943d8b0d617f80081b

SHA256
69587f1d379c2b52706a6a184b88d314d6020a63814c7295ecc57306846933c4

SHA512
7755dac83f6feed1cdfdf08d8ae07186ccbdd34af5cd5bbf7d9bfdfb14ced2da78d82a03a6a852ee2845425a342225059e21850e3e085655c8deb3a20bb12813

Download Submit
C:\Windows\SysWOW64\Ceqnmpfo.exe

Filesize
128KB

MD5
ab4ae5025e85db6bdb0325e11e65f6ab

SHA1
8143b1415511ac7cec2aaf7711a384cb6d4df41d

SHA256
94326e4e3456728b7d0cd564fdd2c85eb2dca60c7b71d0496e4372c3f075e37a

SHA512
5ef50a728840b0280b4feb3f3c6ab1495fa23a948c591c8983c0ce2cba0af0fb71a844a638fda4074a167731c9f4434c1ffbd000952e41b666d645f30905a82a

Download Submit
C:\Windows\SysWOW64\Cfbkeh32.exe

Filesize
128KB

MD5
7aae95e2688f3614a24cca0bc407c970

SHA1
c6938163de6ec36f6df2d423e7975c590f023353

SHA256
2d71df70d218de185901b0005ea45b5ef44a1418d51f09ff39000d6203dfb662

SHA512
e5e709eef691622c6847ecc755f5d97d4f05121aef0df6d46fdf3ba920c73940ff06b3abb92eb2d54127d8a350971995ab9c3e73c4273c0244282a72b786692d

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
128KB

MD5
3df7a16149660b05858a7a0c4dc911f4

SHA1
11d7753369fc02b3c4110bc2535a25602d93a0e0

SHA256
e35ccb74982705346e69095c16bcc465e65de30a34020d30e67449d79bd16d24

SHA512
d79550e31c67d6fda7cfc28652e80da67cb77322fb013a69740e51e3af4222006e04654e5f360d5e33f1b6d771d3c43cb86917bf49f7e54fe4300f071671b23c

Download Submit
C:\Windows\SysWOW64\Chcddk32.exe

Filesize
128KB

MD5
fb25cf50780feaf89cf92870efcd712a

SHA1
f9da939ad0c07b4e8d08d972a2c0bda2de38a4b3

SHA256
22e88a2188c4e5a1a6d78a55143fd6922c31edee3db901b3a3188e163074a6bc

SHA512
a4c0fc420c59737c59fad62190cdaf28f31b58609c0a0f684f8bcf07c3088a21f7354889633a35d7c96364b5f24bd5b4c25644f5d173acca00dac75c02cc089c

Download Submit
C:\Windows\SysWOW64\Cmlcbbcj.exe

Filesize
128KB

MD5
8f7398c47f0c6a09aaf764f689cb6208

SHA1
050f7e77e1fb962a6110d3b2315127580406daf0

SHA256
1a4bf78f94949ef0890c629e87f7542acadbdb5e248121dd051d74a1d124754a

SHA512
91a72d9bcfc027781fc00c5cdc57fc8897e37bb4dcb68e2f9ac182353486f659791ca699826c15047f9ed92015342c8f162fd7b6129420b053f3e15f541ca5e6

Download Submit
C:\Windows\SysWOW64\Cmnpgb32.exe

Filesize
128KB

MD5
9aadbab937fb18e43a250ef66db33d55

SHA1
f28b0fe631379de9139f8c2f4a3867e04be1c73a

SHA256
059a50c6a53edc15fd447067cf3435754c872c3a6f3d79550a9421efc813b28d

SHA512
2158ed334eeb28d9b6b547f24ea1375b10243eaa9036bf8500d0b9e30873f90052ed7a3a01803a3da250bd90e0251e8832b015644c28cfb3562f54aa88320bd7

Download Submit
C:\Windows\SysWOW64\Cnffqf32.exe

Filesize
128KB

MD5
b415d889363d1ad342c1beaf451e5293

SHA1
ea3ee9ff521a3c32ccdf435f0e636b759ad01523

SHA256
bed4f35c0597aa52efdae5897050760b46515897decce95e87c7b5cd3114ad14

SHA512
b5aa4631bdc69857f2edb76087334b92021aac92d3deb4f6a535784cd8d1911696afc351676e4ea3716eb2d622f3271a185b2c5fb04502ba29fe38934f34d973

Download Submit
C:\Windows\SysWOW64\Cnnlaehj.exe

Filesize
128KB

MD5
201c85b6566b7f267840cc7cc5c103b5

SHA1
0222afb6ca38e8ff1cd7e14ab3113132dd8646a7

SHA256
eb5d1dce1196a484b5aeb478f47e2336d187ceabc002bbe2ed60d10f94a5cf95

SHA512
dc0b26190dc67b16b40d2a09dde65430ffdfe88ed98303e3c4f6c34432c9bc8064393c4aeae2a5275effdd01fb24a2340825ae5d508f6f631d84c261250440bb

Download Submit
C:\Windows\SysWOW64\Danecp32.exe

Filesize
128KB

MD5
57eb2b37d51ae678ead756dafbbb4d49

SHA1
659c299b699c214ae183da4d79baeebccb33a213

SHA256
0dd3dedb84eda65ed5d62159d0ac5c5837a6015690beabb5d55779ef01d500ae

SHA512
8925aa5aa6907632d7f37e1d04fa1046d773819204d86f4aa2819ca36d64e003749367e255583b1e3710feafa3cb527160487497a6f133bd5196fda8e30baf15

Download Submit
C:\Windows\SysWOW64\Ddakjkqi.exe

Filesize
128KB

MD5
a0a894deaa2dd8d61e25c18890cd3891

SHA1
3c261ccf6ffe72a8d9cc6477f053245bb0e67f00

SHA256
f41a0b3a022aadf015c33b33020aa7840541d16d7e5048ce9b4ed195c17f292e

SHA512
a41678d4bf8f43cfdbb86314aaffbf6c9d914aa182c5db672913342fa860bc9a7fdd82c111dd2ccd1f92f318bc457a45c327a12b160d36c94e82d10c08c6b64e

Download Submit
C:\Windows\SysWOW64\Ddjejl32.exe

Filesize
128KB

MD5
becd827e7294c83e6301c0b4daff276c

SHA1
a12a6de4f7f33bb5e6b91b16f6aad59aaae44ddb

SHA256
fff1e3ea1421959f574ade3ec846396806cad519c2d91b36be15082b27ac5f88

SHA512
f28c9c86df1e9bb3b19a4e40d22411ae4788143e547fcd59fac2e09d145909e43e5dd93dd564c4cc1178014a9a1a7bf0dd4bb0688bf7b3eb99d0672b88a9c17d

Download Submit
C:\Windows\SysWOW64\Ddmaok32.exe

Filesize
128KB

MD5
a819c14718df18c5ae5d8f6ca777c861

SHA1
2abc3ae31163e1dabaeb6afcf6e53f15283277e8

SHA256
93c722133a00221b023cc0506fa7b6778fa4408fc2ff14f7834f1c6f8900a796

SHA512
dc9bc89b030aff3016bd7dadfe5b0b8244d841d7bd5ed3f00271248e761dd5372f22ca617994529f561ef3f03a3a74eebcc3294a0bfb1cbb4ca294e39fd5b24a

Download Submit
C:\Windows\SysWOW64\Deagdn32.exe

Filesize
128KB

MD5
401786b36334f2d62f16070e54ce529b

SHA1
96aa7cfc47599a9e7f00240d1d19a59d8d807625

SHA256
66592c7a3c3b0fbbd3b12f47d880e7c0d579467d22ffccfbc43d2c98c3ecbf76

SHA512
408fe6362218a166a26728a11b3e08552e24019ab14aa42b4d50cdfb96055299879d369855175969a187a603263b49eadc7236b19449fd867823f52010f5a089

Download Submit
C:\Windows\SysWOW64\Dfiafg32.exe

Filesize
128KB

MD5
b7323b8d5b3fdd0bb57d021756d46d85

SHA1
acce34d95cb71ee206c5af251fb77124648c1911

SHA256
b2d8fe52c1d0223e7a8399911568a37cd43b9141e1dab7a82be54001fcfbc6aa

SHA512
d9db23051c3913ef178d694b21c42ed69622d50081f9c563bcfa50c4298f8d88241d3c4912bbf58c4e82fd3ee13cc31141e921235f682072fe145ab140bbee65

Download Submit
C:\Windows\SysWOW64\Dfnjafap.exe

Filesize
128KB

MD5
042acd11f431aa046141203aeae8429d

SHA1
5e5f51030d28d0d94f97ac3ffa69fcdeec30abd0

SHA256
077dcea8d3eb04aae23bd87cf20b1ee00de6c471d01e1cbe91890cb015acf1f5

SHA512
62a3cab223b683047cb671c0c13847191a354cbce582d52af7fe72ae375af76d85e5e39a7f1083434af626289c55a1342137af3e1f26c96fd51a1277ce17ce75

Download Submit
C:\Windows\SysWOW64\Dmcibama.exe

Filesize
128KB

MD5
ac033737740f6249b68e8f1c19761f47

SHA1
fe4529491d55d4a378da06e362153247aaa952a5

SHA256
87e49759afc22f40bcdb65bb1d113db9725969bd75045f64a6171e8455246711

SHA512
9770325aa20f5b27b6e6d4e4752d4085a96a95f6d5564eba7aba82b07f841eee2ea6776a4c89a778f88f06b046454bcaf2f3a173b79c3d66333d12f6b25174c5

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
128KB

MD5
4641861db28b25d9fd2869df7831a41f

SHA1
ecb6842f871e450cd42d61b5dc0212adcb998c4d

SHA256
5cd6f7458a5d9e15fcfbcd61147df678ea4cec72dcbc19df09d3cf1b9457ae2c

SHA512
0ccc493977523c0410b950315a83a44ab6aebf8500e871669a4260068e7b71cf57b65bf7001123a4c0263e84069492425fecb1f1a6c85694382e7e03bc6fe7e6

Download Submit
C:\Windows\SysWOW64\Dodbbdbb.exe

Filesize
128KB

MD5
b1c8b702b1ad77297e378ea3a1fe4723

SHA1
d7ac90b9cb10440d38a7a0cbd30fcb79b449641d

SHA256
8098a5ec6b15367724abee8f8c9e31443fa6bbe554d212a96497741bb8292d83

SHA512
fb3c8d09d5a220122547c2d9eb5fdd59f44d34c4de759ac34211dcab093441806afe9a6c6661255f1c538c1a0dfae0db254efcc7f09aed7e4294510a1b6249ce

Download Submit
C:\Windows\SysWOW64\Dopigd32.exe

Filesize
128KB

MD5
e523931d8c9fc1ed56f7519447d55ef1

SHA1
06565d53186fdceef38f9834039517f1bcf5ed71

SHA256
523049d5b0d96280efa75d6f372a4c3f9781a736d40687873325d8627b46cf9e

SHA512
00dd1e6346910d1ca5ee9056214b9e50d4ef3497c06182edb0e7503ff2e98095dd92c6eef4359406593270b0acf5de49c974ea1dd56367afc1cb819358676a93

Download Submit
C:\Windows\SysWOW64\Eifnachf.dll

Filesize
7KB

MD5
859aae1d72502b18281892c4e7d34704

SHA1
6627a5cd2cb010ebd1f8008067b2c3d7b68b3607

SHA256
e261b868aaf0bf3456f3a10405d2b491b6464f1c49907cae656eab703460649c

SHA512
88530468586b2a97acf0bee948d5570af3dce3733a654acdf45c99526f53e403d68e5c2fec1a96ae32cf01d7faf517a5c413abad8b77b78bb03fb0617d4e0fe4

Download Submit
memory/536-96-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/536-7-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/640-133-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/640-185-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/808-150-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/808-47-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1120-15-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1120-113-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1204-81-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1204-179-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1308-180-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1308-177-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1512-71-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1512-176-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1912-121-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2032-64-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2032-167-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2388-124-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2388-186-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2452-111-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2940-23-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2940-123-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3260-158-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3260-56-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3480-122-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3580-79-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3580-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3616-112-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3620-132-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3620-32-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3728-151-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3728-183-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4608-142-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4608-184-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4856-159-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4856-182-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/5064-39-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/5064-141-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/5072-168-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/5072-181-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads